git: de60db7469f0 - stable/15 - bcm2835_audio: Comment out vchi_service_release()

The branch stable/15 has been updated by christos:

URL: https://cgit.FreeBSD.org/src/commit/?id=de60db7469f057748435281d147143f3c8b35474

commit de60db7469f057748435281d147143f3c8b35474
Author:     Xuqing Yang <rigelyoung@icloud.com>
AuthorDate: 2026-08-18 20:17:44 +0000
Commit:     Christos Margiolis <christos@FreeBSD.org>
CommitDate: 2026-09-02 09:38:58 +0000

    bcm2835_audio: Comment out vchi_service_release()
    
    bcm2835_audio_release() calls vchi_service_close() and then
    unconditionally calls vchi_service_release() with the same service
    handle.
    
    In the VCHI shim implementation, a successful vchi_service_close() calls
    service_free(service). The subsequent vchi_service_release() therefore
    dereferences a freed SHIM_SERVICE_T object when it reads
    service->handle, resulting in a use-after-free panic.
    
    vchi_service_release(), however, releases a reference which might block
    vchi_service_close() from completing successfuly, so comment it out
    instead of removing it altogether, until further testing is done.
    
    PR:             297187
    MFC after:      2 weeks
    Reviewed by:    markj
    Differential Revision:  https://reviews.freebsd.org/D58921
    
    (cherry picked from commit 95c04b25323d59da43203a08e56db141ac37181b)
---
 sys/arm/broadcom/bcm2835/bcm2835_audio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/arm/broadcom/bcm2835/bcm2835_audio.c b/sys/arm/broadcom/bcm2835/bcm2835_audio.c
index 0915bee677ef..8355fa62d21e 100644
--- a/sys/arm/broadcom/bcm2835/bcm2835_audio.c
+++ b/sys/arm/broadcom/bcm2835/bcm2835_audio.c
@@ -295,10 +295,10 @@ bcm2835_audio_release(struct bcm2835_audio_info *sc)
 	int success;
 
 	if (sc->vchi_handle != VCHIQ_SERVICE_HANDLE_INVALID) {
+		/* XXX vchi_service_release(sc->vchi_handle)? */
 		success = vchi_service_close(sc->vchi_handle);
 		if (success != 0)
 			printf("vchi_service_close failed: %d\n", success);
-		vchi_service_release(sc->vchi_handle);
 		sc->vchi_handle = VCHIQ_SERVICE_HANDLE_INVALID;
 	}